JWT Decoder — Analyze & Decode JSON Web Tokens Online

Decode and analyze JSON Web Tokens (JWT) with our JWT Decoder. The tool automatically separates the token into its three parts (header, payload, signature) and displays the decoded content in formatted JSON. Recognizes common algorithms like HS256, RS256, ES256 and shows expiration information (exp, iat, nbf). Note: this tool only decodes tokens; signature verification requires the secret key. All operations are performed locally in your browser.

Features

Header Decoding: View algorithm (alg) and token type (typ)
Payload Extraction: Decode claims and user data
Expiry Checking: Automatically verify if token has expired
Syntax Highlighting: Color-coded JSON for better readability
Signature Display: Show Base64URL-encoded signature
Client-Side: All processing happens locally in your browser

Important Security Information

Decoding ≠ Verification: This tool only decodes the JWT. It does NOT verify the signature.
Never trust unverified tokens: Always verify signatures server-side before using JWT data.
Sensitive Data: JWTs are Base64-encoded, not encrypted. Anyone can decode them.
Secret Keys: Never paste secret keys into online tools or client-side code.

For production applications, use proper JWT libraries like jsonwebtoken (Node.js), PyJWT (Python), or firebase/php-jwt (PHP).

JWT Structure

A JWT consists of three Base64URL-encoded parts separated by dots (.):

HEADER.PAYLOAD.SIGNATURE

Header

Contains token metadata:

alg: Algorithm (HS256, RS256...)
typ: Token type (JWT)

Payload

Contains the claims:

sub: Subject (user ID)
exp: Expiration time
iat: Issued at
Custom claims

Signature

Verifies token integrity:

HMAC or RSA signature
Requires secret key to verify
Prevents tampering

Useful Resources

Wikipedia: JSON Web Token Beginner-friendly introduction to JWT concepts and structure

JWT.io Official JWT website with debugger and library information

RFC 7519: JSON Web Token Official IETF specification for JWT

Auth0: Introduction to JSON Web Tokens Comprehensive guide to understanding and using JWTs

MDN: SubtleCrypto Web Crypto API for cryptographic operations in JavaScript